Attorney's Docket No.: 15670-075001 / SD2004-151 
REMARKS 

Claims 1-35, 69-79, 88, and 89 are pending. Claims 1, 69, 
88, and 89 are in independent form. Claims 36-68 1 and 80-87 have 
been canceled pursuant to their withdrawal from consideration, 
without disclaimer, and subject to applicant's right to pursue 
the subject matter of the canceled claims in a divisional 
application . 

Applicant hereby affirms the provisional election of Group 
I, claims 1-35 and 69-79 subject to the footnote above. 

Claims 1 and 69 were rejected under 35 U.S.C. § 102(e) as 
anticipated by U.S. Patent No. 6,738,814 to Cox et al . 
(hereinafter "Cox"). 

As best understood, the rejections of claims 1 and 69 are 
based on the contention that data packets inherently constitute 
"reductions of the original data." 

Although Applicant believes that one of ordinary skill, 
when armed with the specification, would not have reasonably 
considered the recited reduction of data items to have included 
packetization, claims 1 and 69 have been amended to recite that 
the reduced data items have a smaller size and a constant 

1 Page 3 of the Office action mailed October 4, 2007 refers to claims 36-58 
and 80-87 being withdrawn from consideration, rather than claims 36-68 and 
80-87 being withdrawn. Applicant believes that this is a typographical error 
and has acted accordingly. If this belief is in error and claims 59-68 were 
not, in fact, withdrawn from consideration, applicant respectfully requests 
that the present response be considered bona fide, a new Office action 
clarifying the status of the claims be issued, and an extended period for 
response provided. 
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predetermined relation with the data items and at least some of 
the data items in the data collection that differ are reduced to 
the same reduced data item. Such data reduction is described, 
e.g., in para. [0072] of the specification. Moreover, the 
recited reduced data items exclude data packets. Indeed, 
packetization is understood to increase the net size of a data 
item, e.g., as headers are added to packets. 

Accordingly, claims 1 and 69 and the claims dependent 
therefrom are not anticipated by Cox. Applicant respectfully 
requests that the rejections of claims 1, 69, and the claims 
dependent therefrom be withdrawn. 

New claim 88 has been added to recite subject matter 
related to that recited in former claim 12. Please note that 
changes have been made. Former claim 12 was also rejected under 
35 U.S.C. § 102(e) as anticipated by Cox. 

New claim 88 recites that an additional test is carried out 
on frequently occurring sections of message information. 
Carrying out the additional test includes maintaining a first 
list of unassigned addresses, wherein the unassigned addresses 
are maintained as reduced addresses that have a smaller size and 
a constant predetermined relation with the unassigned addresses 
and at least some of the unassigned addresses that differ are 
reduced to the same reduced address, forming a second list of 
source addresses that have sent to the unassigned addresses on 
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said first list, wherein the source addresses are maintained as 
reduced addresses that have a smaller size and a constant 
predetermined relation with the source addresses and at least 
some of the source addresses that differ are reduced to the same 
reduced address, and comparing a current source of a frequently 
occurring section to said second list. 

As best understood, the rejection of former claim 12 was 
based on the same contention as the rejection of former claim 1, 
namely, that "data reducing" inherently includes packetization . 

Even if one of ordinary skill were to reasonably consider 
packetization to be a form of "data reducing" (a contention with 
which applicant respectfully disagrees) , former claim 12 recited 
that unassigned addresses maintained in a first list were 
reduced. Applicant respectfully submits that Cox neither 
describes nor suggests that addresses themselves, much less a 
list of such addresses, be packetized. 

Accordingly, claim 88 is not anticipated by Cox. 

New claim 81 has been added to recite subject matter 
related to the recited in former claim 19. Please note that 
changes have been made. Former claim 19 was rejected under 35 
U.S.C. § 103(a) as obvious over Cox and U.S. Patent No. 
6,829,635 to Townshend (hereinafter "Townshend" ) . 
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The rejections of former claim 19 and other claims under 3 5 
U.S.C. § 103(a) are based on the contention that it would have 
been obvious for one of ordinary skill to have combined Cox and 
Townshend to have arrived at the recited subject matter. 

Applicant respectfully disagrees for a variety of reasons. 
In this regard, Cos describes the blocking of denial of service 
and address spoofing attacks on a network. See, e.g., Cox, col. 
1, line 8-10, 56-60. According to Cox, a denial of service 
attack is one in which an attacker attempts to prevent others 
from using a network and an address spoofing attack is one in 
which attacker fakes an internal address to get around or into 
standard address filtering schemes. See, e.g., id., col. 2, 
line 59-67. 

Cox describes that these attacks can be blocked by 
analyzing incoming data packets. See, e.g., id., col. 3, line 
1-3. As best understood, Cox describes three different 
approaches to analyzing incoming data packets, namely: 

-"analyzing the incoming packet against known patterns" 
(see, e.g., id., col. 3, line 33-43); 

-determining "if the source IP address . matches an internal 
[IP] address" (see, e.g., id., col. 3, line 33-43); and 

-checking "whether or not an acknowledgment [from the 
requestor for a connection] has been received" {see, e.g., id., 
col. 4, line 17-24) . 
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Please note that Cox is silent as to the origins of the "known 
patterns" against which incoming packet are to be analyzed in 
the first approach described above. 

None of Cox' approaches to analyzing incoming data packets 
are understood to relate to the automatic identification of 
common content to use in identifying an intrusive network 
attacks. Instead, Cox focuses on blocking attacks on a network, 
not on the identification of common content to use in blocking 
attacks . 

As for Townshend, Townshend is directed to identifying bulk 
electronic mail. See, e.g., Townshend, col. 1, line 64-65. 
According to Townshend, bulk electronic mail is unsolicited 
electronic mail that is sent in large volumes and can be 
identified by counting the reoccurrence of signature elements in 
different messages. See, e.g., Townshend, col. 1, line 64 -col. 
2, line 16. Townshend' s bulk electronic mail is thus not 
believed to be an intrusive network attack. 

The obviousness rejections of former claim 19 and other 

claims under 35 U.S.C. § 103(a) were based on the contention 

that one of ordinary skill would have combined Townshend and Cox 

"to improve how proactively the invention behaves 
and allow for better filtering of data which have 
[the] potential of causing network attacks." See 
Office action mailed October 4, 2007, page 12, 
final paragraph. 
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As a threshold matter. Applicant notes that this amounts to 
a bald contention combining Townshend and Cox would have been 
obvious because the combination would have been an improvement. 
However, there is nothing in either Townshend or Cox that 
supports this contention. Instead, the rejection is relying 
upon the improvements described in Applicant's own specification 
to reconstruct the claimed subject matter. Such hindsight-based 
reconstruction has never been an acceptable approach to 
establishing obviousness. 

Moreover, as discussed above, even if Townshend and Cox 
were combined, one of ordinary skill would not have arrived at 
the recited subject matter. The present claims all relate to 
automatically identifying common content to use in identifying 
an intrusive network attack. Cox merely describes that his 
"known patterns" are "known" and Townshend relates to 
identifying unsolicited electronic mail that is sent in large 
volumes. Thus, the subject matter described in Cox and 
Townshend would not lead one of ordinary skill to the recited 
subject matter even if Cox and Townshend were combined. 

Accordingly, new claim 81 is not obvious over Cox and 
Townshend. 
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It is believed that all of the pending claims have been 
addressed. However, the absence of a reply to a specific 
rejection, issue, or comment does not signify agreement with or 
concession of that rejection, issue, or comment. In addition, 
because the arguments made above may not be exhaustive, there 
may be reasons for patentability of any or all pending claims 
(or other claims) that have not been expressed. Finally, 
nothing in this paper should be construed as an intent to 
concede any issue with regard to any claim, except as 
specifically stated in this paper, and the amendment of any 
claim does not necessarily signify concession of unpatentability 
of the claim prior to its amendment. 

Applicant asks that all claims be allowed. Please apply 
the Petition for an Extention of Time fee, and any other charges 
or credits, to deposit account 06-1050. 
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